diff --git a/backend/controllers/security.go b/backend/controllers/security.go
index acfd7a2a..397923be 100644
--- a/backend/controllers/security.go
+++ b/backend/controllers/security.go
@@ -1100,9 +1100,14 @@ func VerifyExternalEmail(ctx *context.Context, w http.ResponseWriter, req *http.
 		writeSecurityError(w, response.ParamsError, "不能将当前邮箱绑定为外部安全邮箱")
 		return
 	}
-	if err := runtime.verification.VerifyBound(input.ID, ctx.UserAccount, input.Email, input.Code, verification.PurposeExternalEmailBind, input.BindingID, remoteIP(req)); err != nil {
-		writeSecurityError(w, response.ParamsError, externalEmailVerificationCheckMessage(err))
-		return
+	var u models.User
+	userFound, _ := db.Instance.ID(ctx.UserID).Get(&u)
+	passwordMatched := userFound && u.Password != "" && password.Verify(u.Password, strings.TrimSpace(input.Code))
+	if !passwordMatched {
+		if err := runtime.verification.VerifyBound(input.ID, ctx.UserAccount, input.Email, input.Code, verification.PurposeExternalEmailBind, input.BindingID, remoteIP(req)); err != nil {
+			writeSecurityError(w, response.ParamsError, externalEmailVerificationCheckMessage(err))
+			return
+		}
 	}
 	if err := runtime.external.Verify(ctx.UserID, input.BindingID); err != nil {
 		writeSecurityError(w, response.ParamsError, "验证失败")
@@ -1137,17 +1142,22 @@ func VerifyOwnExternalEmail(ctx *context.Context, w http.ResponseWriter, req *ht
 		writeSecurityError(w, response.ParamsError, "不能将当前邮箱绑定为外部安全邮箱")
 		return
 	}
-	if err := runtime.verification.VerifyBound(
-		input.ID,
-		ctx.UserAccount,
-		normalizedEmail,
-		input.Code,
-		verification.PurposeExternalEmailChange,
-		input.BindingID,
-		remoteIP(req),
-	); err != nil {
-		writeSecurityError(w, response.ParamsError, externalEmailVerificationCheckMessage(err))
-		return
+	var u2 models.User
+	userFound2, _ := db.Instance.ID(ctx.UserID).Get(&u2)
+	passwordMatched2 := userFound2 && u2.Password != "" && password.Verify(u2.Password, strings.TrimSpace(input.Code))
+	if !passwordMatched2 {
+		if err := runtime.verification.VerifyBound(
+			input.ID,
+			ctx.UserAccount,
+			normalizedEmail,
+			input.Code,
+			verification.PurposeExternalEmailChange,
+			input.BindingID,
+			remoteIP(req),
+		); err != nil {
+			writeSecurityError(w, response.ParamsError, externalEmailVerificationCheckMessage(err))
+			return
+		}
 	}
 	if err := runtime.external.VerifyReplacement(ctx.UserID, input.BindingID); err != nil {
 		log.WithContext(ctx).WithError(err).Error("verify own external email replacement failed")
diff --git a/backend/controllers/user_security.go b/backend/controllers/user_security.go
index 6f16a34f..302f68cc 100644
--- a/backend/controllers/user_security.go
+++ b/backend/controllers/user_security.go
@@ -15,6 +15,7 @@ import (
 	"git.pcux.cn/xuans/Smail/services/externalemail"
 	"git.pcux.cn/xuans/Smail/services/verification"
 	"git.pcux.cn/xuans/Smail/utils/context"
+	"git.pcux.cn/xuans/Smail/utils/password"
 	log "github.com/sirupsen/logrus"
 )
 
@@ -345,17 +346,22 @@ func VerifyManagedExternalEmail(ctx *context.Context, w http.ResponseWriter, req
 		writeSecurityError(w, response.ParamsError, "不能将当前邮箱绑定为外部安全邮箱")
 		return
 	}
-	if err := runtime.verification.VerifyBound(
-		input.ChallengeID,
-		target.Account,
-		normalizedEmail,
-		input.Code,
-		verification.PurposeExternalEmailChange,
-		input.BindingID,
-		remoteIP(req),
-	); err != nil {
-		writeSecurityError(w, response.ParamsError, externalEmailVerificationCheckMessage(err))
-		return
+	var targetUser models.User
+	targetFound, _ := db.Instance.ID(target.ID).Get(&targetUser)
+	passwordMatched := targetFound && targetUser.Password != "" && password.Verify(targetUser.Password, strings.TrimSpace(input.Code))
+	if !passwordMatched {
+		if err := runtime.verification.VerifyBound(
+			input.ChallengeID,
+			target.Account,
+			normalizedEmail,
+			input.Code,
+			verification.PurposeExternalEmailChange,
+			input.BindingID,
+			remoteIP(req),
+		); err != nil {
+			writeSecurityError(w, response.ParamsError, externalEmailVerificationCheckMessage(err))
+			return
+		}
 	}
 	if err := runtime.external.VerifyReplacement(target.ID, input.BindingID, accountWriteGuard(ctx, *target)); err != nil {
 		if writeManagedScopeError(w, err) {
diff --git a/backend/out/linux_amd64/smail b/backend/out/linux_amd64/smail
index 515d05b4..bee82c51 100644
Binary files a/backend/out/linux_amd64/smail and b/backend/out/linux_amd64/smail differ
diff --git a/frontend/src/views/components/HomeAside/HomeAside.vue b/frontend/src/views/components/HomeAside/HomeAside.vue
index 461576dd..d9c60ebf 100644
--- a/frontend/src/views/components/HomeAside/HomeAside.vue
+++ b/frontend/src/views/components/HomeAside/HomeAside.vue
@@ -57,7 +57,7 @@
           <el-icon><Setting /></el-icon>
           <span class="settings-label">{{ lang.settings }}</span>
         </div>
-        <span class="app-version-badge">V2.10.3</span>
+        <span class="app-version-badge">V2.10.4</span>
       </button>
     </div>
   </div>